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AO 93 (SONY Rev. 05/10) Search and Seizure Warrant 


United States District Court 

for the 

Southern District of New York 
In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) Case 

Three Electronic Devices, See Attachment A ^ 

) 

SEARCH AND SEIZURE WARRANT 

Y'oY~~'Any'authorized:law^fe — -—■“■■■■■"" --- 

An application by a federal law enforcement officer or an attorney for the government requests the search 
ofthe following person or property located in the _ Southern District of _ New York _ 

(identify the person or describe the property to be searched and give its location)'. 

Three Electronic Devices, See Attachment A 

The person or property to be searched, described above, is believed to conceal (identify the person or describe the 
property to be seized) \ 

See Attachment A ,,: i .1 )'; 1,, 

I find that the affidavit(s), or any recorded testimony, establish probable cause to search, and sdize the person or 
property. zV’ . ' / 

YOU ARE COMMANDED to execute this warrant on or before ,/B- ■ . ‘ ; 

‘ \ (not to exceed 14 days) 

□ in the daytime 6:00 a.m. to 10 p.m. sT at any time in the day or night as I ’find reasonable cause has been 

established. 

Unless delayed notice is authorized below, you must give a copy ofthe warrant aiid ^'receipt fot the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy hhd receipt at the 
place where the property was taken. 



The officer executing this warrant, or an officer present during the execution of the wap-ant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to the Cltirk of theUourt. ^ 

y/ Upon its return, this warrant and inventory shou ld be filed under seal bj/^ the Gibrk of the Court: 


USMJ Initials 


Sf i find that immediate notification may have an adverse result listed in i S § 2705'(exeept for delay 

of trial), and authorize the officer executing this warrant to delay notice to thd ;^erson who, or whose-propeiiy, will be 
ox (check the appropriate box) Sffor 30 days (not to exceed $0), \ ' ' 

□until, the facts justifying, the latei: specific date of 


Date and time issued: ^ 




Judge's sighdtuH 



-7^ 


City and state: New York. NY 


Hon. Henry B. Pitman. U.S. Magistrate Judge 

Printed name and title 
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AO 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of wanrant and inventory left with: 

Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 



Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant 
to the Court. 


Date: _ _ 

Executing officer's signature 


Printed name and title 
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Attachment A t 

I. Devices to be Searched 

The devices to be searched (the “Subject Devices”) are described as: j 

a. Subject Device-1: A black and red USB drive with a white label that says “Tracking | 

#: 180208140208.” j 

h. Subject Device-2: A silver DVD with a white label that reads “Cohen — 

2018.03.07.” j 

c. Subject Device-3: A white DVD labelled “2-28-18 Cohen SW Returns — Google f 

__an d l&l.” . .-. .-. . -- - _ I 

I 

n. Reviev*' of ESI on the Subject Devices 

I 

Law enforcement personnel (including, in addition to law enforcement officers and agents, k 

and depending on the nature of the ESI and the status of the investigation and related proceedings, j 

attorneys for the government, attorney support staff, agency personnel assisting the government in j? 

this investigation, mterpreters, and outside vendors or technical experts under government control) p 

are authorized to review the ESI contained on the Subject Devices for evidence, fiuits, and | 

instrumentalities of one or more violations of 52 U.S.C. §§ 30116(a)(1)(A) and 30109(d)(l)(A)(l) |j 

(illegal campaign contributions) (the “Subject Offense”), as listed below: j 

r 

I 

a. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their 1 

I 

I 

I 

agents or legal representatives, including any nondisclosure agreements and related | 

j 

documents, and any communications related to such agreements. I 

b. Evidence of communications involving Michael Cohen, Donald Trump and/or J 

agents or associates of the Trump Campaign about Stephanie Clifford or Karen 
McDougal, or payments to Stephanie Clifford or Karen McDougal. 

c. Evidence of communications with American Media, Inc., David Pecker, and/or \ 

Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, j 

and/or Karen McDougal. I 

d. Evidence relating to Cohen’s role in the Trump Campaign, and coordination or [ 

consultation with the Trump Campaign. ! 
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e. Evidence of commimications with Donald Trump and/or agents or associates of the t 

f 

Trump Campaign about the Access Hollywood tape. * 

f. Evidence relating to Cohen’s Icnowledge of the campaign finance laws, campaign ' 

contribution reporting requirements, and campaign contribution limits. | 

g. Evidence indicating Michael Cohen’s intent with respect to the Subject Offense, 
including whether the payment to Clifford and any similar payments were made to 
influence the Presidential election. 


2 
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AO 106 (Rev. 06/09) Application for a Search Warrant 


United States District Court 


for the 

Southern District of 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 

Three Electronic Devices, See Attachment A 



Case No. 


APPLICATION FOR A SEARCH WARRANT 


h a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
Dwmrtv to bejearched and.eiveJts locationlL. _ _ 



vSee Attach ment-A- 


located in the 


Southern 


District of 


New York 


, there is now concealed (identify the 


person or describe the property to be seized)', 

PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. 

The basis for the search under Fed. R. Crim. P, 41(c) is (check one or more)'. 
sf evidence of a crime; 

□ contraband, fruits of crime, or other items illegally possessed; 

□ property designed for use^ intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 


Offense Description 


Code Section 

52 DSC 30116(a)(1 )(A), 30109 Illegal campaign contributions 
(d)(1)(A)(1) 


The application is based on these facts: 

PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. 

fif Continued on the attached sheet. 

Delayed notice of 30 days (give exact ending date if more than 30 days: 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet 


) is requested 


Sworn to before me and signed in my presence. 

Date: V- .7- 

City and state: A/0'^ d/ 



. ' Judge ’s signature 

Hon. Henry B. Ritihan, U.S. Magistrate Judge 
Printed hame and title 
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TO BE FILED UNDER SEAL 

Agent Affidavit in Support of 
Application for a Search Warrant 


Special Agent of the United States Attorney’s Office for the Southern 

DiMfict of New^YarLX‘‘US7ro’’)7heih^uryswdihrd^hses and says: 

I. Introduction 
A. Affiant 

1. I have been a Special Agent with the US AO since August 2016. I previously served 
as a Special Agent with the United States Department of Labor Inspector General from May 2011 
to August 2016. In the course of my experience and training in these positions, I have participated 
in criminal investigations into federal offenses involving a wide array of financial crimes, 
including frauds on financial institutions, and have been involved in investigations involving 
violations of campaign fin ances laws and regulations. I also have training and experience 
executing search warrants, including those authorizing the search of email accounts and electronic 
devices. 

2. I make this Affidavit in support of an application pursuant to Rule 41 of the Federal 
Rules of C rimina l Procedure for a warrant to search the electronic devices specified below (the 
“Subject Devices”) for the items and information described in Attachment A. This affidavit is 
based upon my personal knowledge; my review of documents and other evidence; my 
conversations with other law enforcement personnel; and my training, experience and advice 
received concerning the use of computers in criminal activity and the forensic analysis of 


UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 


In the Matter of the Application of the United 
States Of America for a Search Warrant for Three 
Electronic Devices, USAO Reference No 
2018R00127 


SOUTHERN DISTRICT OF NEW YORK) ss.: 


2 
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electronically stored information (“ESI”). Because this affidavit is being submitted for the limited 
purpose of establishing probable cause, it does not include all the facts that I have learned during 
the course of my investigation. Where the contents of documents and the actions, statements, and 
conversations of others are reported herein, they are reported in substance and in part, except where 
otherwise indicated. 

B. Prior Warrants and the Subject Devices 

3. The USAO and the Federal Bureau of Investigation (“FBI”) have been 
investigating, among other things, a scheme by Michael Cohen to defraud multiple banks. Cohen 
is an attorney who currently holds himself out as the personal attorney for President Donald Trump, 
and who previously served for over a decade as an executive in the Trump Organization, an 
international conglomerate with real estate and other holdings. 

4. In connection with an investigation then being conducted by the Office of the 
Special Counsel (“SCO”), the FBI sought and obtained from the Honorable Beryl A. Howell, Chief 
United States District Judge for the District of Columbia, three search warrants for emails and 
other content information associated with two email accounts used by Cohen, and one search 
warrant for stored content associated with an iCloud account used by Cohen. Specifically; 

a. On or about July 18,2017, the FBI sought and obtained a search warrant for 
emails in the account^^^^^^^|^gmail.com (the “Cohen Gmail Accounf’) sent or received 
between January 1, 2016 and July 18, 2017. This warrant, which is numbered 17-mj-00503, is 
attached as Exhibit A (the “First Cohen Gmail Warrant”). 

b. On or about August 8, 2017, the FBI sought and obtained a search warrant 
for content stored in the iCloud account associated with Apple ID ^^^^^^|@gmail.com (the 
“Cohen iCloud Account”). This warrant, which is numbered, 17-mj-00570, is attached as Exhibit 
D (the “Cohen iCloud Warrant”). 


3 
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c. On or about November 13, 2017, the FBI sought and obtained a search 
warrant for emails in the Cohen Gmail Account sent or received between June 1, 2015 and 
November 13,2017. This warrant, which is numbered 17-mj-00855, is attached as Exhibit B (the 
“Second Cohen Gmail Warrant”). 

d. On or about November 13, 2017, the FBI sought and obtained a search 
warrant for emails in the account^^^^^^^^^^^^^^the “Cohen MDCPC Account”) sent or 
received between the opening of the Cohen MDCPC Account^ and November 13, 2017. This 
warrant, which is numbered 17-mj-00854, is attached as Exhibit C (the “First Cohen MDCPC 
Warrant”). 

5. The SCO has since referred certain aspects of its investigation into Cohen to the 
US AO, which is worldng with the FBI’s New York Field Office. As part of that referral, on or 
about February 8, 2018, the SCO provided the USAO with all non-privileged emails and other 
content information obtained pursuant to the First Cohen Gmail Warrant, Second Cohen Gmail 
Warrant, and Cohen MDCPC Warrant. On or about March 7, 2018, the SCO provided the USAO 
with all non-privileged content obtained pursuant to the Cohen iCloud Warrant.^ A filter team 
working with the SCO had previously reviewed the content produced pursuant to these warrants 
for privilege. 

6. On or about February 28, 2018, the USAO sought and obtained search warrants for 
emails in Cohen Gmail Account and Cohen MDCPC Account, among other accounts, sent or 

^ Based on my review of this warrant and the affidavit in support of it, I know that the warrant did 
not specify a time period, but the affidavit indicated that, pursuant to court order, the service 
provider had provided non-content information for the Cohen MDCPC Account that indicated that 
the accoxmt contained emails from the approximate period of March 2017 through the date of the 
warrant. 

^ The SCO had previously provided a subset of this non-privileged content on or about February 
2,2018. 


4 
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received between November 14, 2017 and February 28, 2018. These warrants, which are both 
numbered 18 Mag. 1696, are attached as Exhibits E (the “Third Cohen Gmail Warrant”) and F (the 
“Second Cohen MDCPC Warrant”), respectively. The content produced pursuant to these 
warrants is being reviewed for privilege by an SDNY filter team. 

7. The search warrants described above are referred to collectively herein as the “Prior 
Warrants.” 

8. The returns of the Prior Warrants are presently contained on three electronic 
devices. In particular: 

a. Subject Device-1: The non-privileged emails and content returned in 
response to the First Cohen Gmail Warrant, the Second Cohen Gmail Warrant, and the First Cohen 
MDCPC Warrant are contained on Subject Device-1, which is particularly described as a black 
and red USB drive with a white label that says “Tracking #: 180208140208.” 

b. Subject Device-2: The non-privileged content returned in response to the 
Cohen iCloud Warrant is contained on Subject Device-2, which is particularly described as one 
silver DVD with a white label that reads “Cohen — 2018.03.07.” 

c. Subject Device-3: The content returned in response to the Third Cohen 
GmaU Warrant and the Second Cohen MDCPC Warrant is contained on Subject Device-3, which 
is particularly described as one white DVD labelled “2-28-18 Cohen SW Returns — Google and 
l&l.” 

9. The Subject Devices are presently located in the Southern District of New York. 

C. The Subject Offenses 

10. The affidavits in support of the Prior Warrants describe evidence of several 
different courses of conduct by Cohen, including, among other things, false statements to financial 

institutions relating to the purpose of an account he opened in the name of Essential Consultants 

5 







Case l:18-cr-00602-WHP Document 48-6 Filed 07/18/19 Page 10 of 80 


LLC and the nature of funds flowing into that account; false statements and fraudulent omissions 
by Cohen in connection with this attempt to refinance his debts with certain financial institutions; 
and activities undertaken by Cohen on behalf of certain foreign persons or foreign entities without 
having registered as a foreign agent. The Prior Warrants accordingly define the evidence to be 
seized by reference to subject offenses and specific categories of information related to these 


courses of conduct. The subject offenses in the Prior Warrants are summarized as follows: 


Exhibit 

Warrant 

3 

Subiect Offenses in Prior Warrant 

A 

First Cohen Gmail 

18 U.S.C. §§371 (conspiracy to defraud the United States), 1005 (false 


Warrant 

bank entries), 1014 (false statement to financial institution), 1343 (wire 
fraud), 1344 (banlc fraud), 1956 (money laundering), 951 (acting as an 
unregistered foreign agent), and 22 U.S.C. §§611 etseq. (Foreign Agents 
Registration Act (“FARA”)) 

B 

Second Cohen Gmail 
Warrant 

18 U.S.C. §§371 (conspiracy to defraud the United States), 1005 (false 
bank entries), 1014 (false statement to financial institution), 1343 (wire 
fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an 
unregistered foreign agent), and 22 U.S.C. §§ 611 seq. (FARA) 

C 

Cohen MDCPC Warrant 

18 U.S.C. §§371 (conspiracy to defraud the United States), 1005 (false 
bank entries), 1014 (false statement to financial institution), 1343 (wire 
fraud), 1344 (bank fraud), 1956 (money laxmdering), 951 (acting as an 
unregistered foreign agent), and 22 U.S.C. §§611 etseq. (FARA) 

D 

Cohen iCloud Warrant 

18 U.S.C. §§ 1014 (false statement to financial institution), 1344 (bank 
fraud), 1956 (money laundering), 951 (acting as an unregistered foreign 
agent), and22 U.S.C. §§ 611 etseq. (FARA) 

E 

Third Cohen Gmail 
Warrant 

18 U.S.C.§§371 (conspiracy to commit offense or to defraud the United 
States), 1005 (false bank entries), 1014 (false statements to financial 
institution), 1343 (wire fraud), 1344 (banlc fraud) 

F 

Second Cohen MDCPC 
Warrant 

18 U.S.C.§§371 (conspiracy to commit offense or to defraud the United 
States), 1005 (false bank entries), 1014 (false statements to financial 
institution), 1343 (wire fraud), 1344 (bank fraud) 


11. Based on my participation in this investigation, including my review of documents 
obtained pursuant to subpoena and court order, my conversations with witnesses and review of 
reports of conversations with witnesses, and my review of publicly available information, I have 


^ On or about February 28,2018, the USAO sought and obtained a Rule 41 warrant, authorizmg it 
to expand its search of the email returns for the warrants attached as Exhibits A-C (the First Cohen 
Gmail Warrant, Second Cohen Gmail Warrant, and First Cohen MDCPC Warrant) for additional 
offenses not authorized in the original warrants for those accounts. The below chart therefore lists 
both the subject offenses listed in the original warrants for these accounts and the subject offenses 
authorized in the February 28, 2018 warrant. 


6 
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learned of evidence of an additional Subject Offense committed by Cohen, described below, which 
was not listed in the Prior Warrants."^ 

12. I am therefore requesting authority to expand the search of the returns of the Prior 
Warrants, as contained on the Subject Devices, for evidence related to the additional Subject 
Offense. As set forth below, in addition to the categories of evidence aheady described in the 
Prior Warrants, there is probable cause to believe that the Subject Devices contain evidence of 
violations of 52 U.S.C. §§ 30116(a)(1)(A) and 30109(d)(l)(A)(l) (illegal campaign contributions) 
(the “Subject Offense”).^ 

II. Probable Cause Regarding the Subject Offense 

13. As set forth above, the USAO and the FBI have been investigating, among other 
things, a scheme by Michael Cohen to defraud multiple banks. During the course of this 
investigation, the USAO and FBI have obtained evidence that Cohen has also committed a criminal 
violation of the campaign finance laws by making an excessive in-kind contribution to the 
presidential election campaign of then-candidate Donald Trump in the form of a $ 130,000 payment 
to Stephanie Clifford, an individual who was rumored to have had an extramarital affair with 
Trump, in exchange for her agreement not to disclose that alleged affair. As set forth below, there 
is probable cause to believe that this payment was intended to keep Clifford from making public 
statements about the rumored affair on the eve of the 2016 presidential election, and thus 
constitutes a campaign contribution in excess of the applicable limit. 


^ As set forth below, I base this application in part on my review of emails and text messages 
obtained pursuant to the Prior Warrants. Each of the cited emails or texts messages is either 
responsive to the applicable Prior Warrant and/or was discovered in plain view during a review of 
the emails or texts returned pursuant to the applicable Prior Warrant. 

^ The Prior Warrants describe categories of information that likely encompass evidence of the 
additional Subject Offense. Nevertheless, in an abundance of caution, I am seeking explicit 
authorization to search the Subject Devices for evidence of the Subject Offense. 


7 
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14. From my review of public sources, I have learned the following: 

a. In or around October 2011, there were rumors published on the gossip websites 
TheDirty.com that Trump had had an extramarital affair with Clifford, an adult film actress whose 
screen name is Stormy Daniels, in or around July 2006. In or about October 2011, Life & Style 
Magazine, a tabloid sold in supermarkets, also published an article, based on the report in 
TheDirty.com, alleging an affair had occurred between Trump and Clifford. Both Trump and 
Clifford, through their representatives, issued denials in response to the articles. 

b. Specifically, on or about October 11, 2011, Keith Davidson, who identified himself 
as Clifford’s attorney, sent a cease and desist letter to TheDirty.com, demanding that the article 
regarding Trump and Clifford be removed from the website. Additionally, on or about October 
12, 2011, Cohen, who was then Executive Vice-President and Special Counsel to the Trump 
Organization, stated to E! News that “[t]he totally untrue and ridiculous story ... emanated from 

a sleazy and disgusting website_The Trump Organization and Donald J. Tramp will be bringing 

a lawsuit. . . [and] Mr. Trump and the Trump Organization would like to thank and commend 
Stormy Daniels and her attorneys for their honesty and swift actions.” 

15. On or about June 16, 2015, Tramp formally launched his 2016 presidential 
campaign. On or about May 4, 2016, Trump became the presumptive Republican Party nominee 
for president, and on July 19, 2016, Tramp officially became the nominee. Based on my review 
of public sources, I have learned that while it does not appear that Cohen had an official title as 
part of the Tramp campaign, on multiple occasions Cohen made public statements on behalf of 
Tramp or his campaign. For instance, on or about August 18, 2016, Cohen appeared on CNN to 
defend Trump’s polling numbers. 


8 





Case l:18-cr-00602-WHP Document 48-6 Filed 07/18/19 Page 13 of 80 


16. On or about October 7, 2016, The Washington Post published online a video and [ 

accompanying audio in which Trump referred to women in what the article described as “vulgar 
terms” in a 2005 conversation with Billy Bush, who was then the host of Access Hollywood. The 
following day, on October 8, 2016, Trump appeared in a video in which he stated, among other 
things, “I’ve said and done things I regret and words released today on this more than a decade old 
video are one of them. Anyone who knows me knows these words don’t reflect who I am. I said 
it. I was wrong and I apologize.” Based on my review of public sources, I also know that 
representatives of the Trump Campaign stated, in sum and substance, that the Access Hollywood 
comment was an old and isolated incident. 

17. Based on my review of public sources, including an article published in Slate 
magazine by a reporter who interviewed Clifford, that around this same time, in or about October 
2016, Clifford was in discussions with ABC’s Good Morning America show and Slate magazine, 
among other media sources, to provide these media outlets with her statement about her alleged 
relationship with Trump. According to the article in Slate, which the author based on' 
conversations 'with Clifford over the telephone and by text message, Clifford wanted to be paid for 
her story or be paid by Trump not to disclose her aeeusation. As , Cohen summarized in a 2018 
email obtained pursuant to the Cohen Email Warrants: “In October 2016, I was contacted by 
counsel for Ms. Clifford stating that news outlets, including ABC News, were pursuiug the 2011 
story of an alleged affair between Mr. Trump and Ms. Clifford.” 

18. From my review of telephone toll records® and information produced pursuant to 
the iCloud Warrant and Cohen Email Warrants, I have learned that in the days following the Access 

® My attribution of certain telephone numbers to certain individuals as described in this 
affidavit is based on my review of the vCard (virtual contact file) obtained from Cohen’s telephone 
pursuant to the iCloud Warrant. 


9 
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Hollywood video, Cohen exchanged a series of calls, text messages, and emails with Keith 
Davidson, who was then Clifford’s attorney, David Pecker and Dylan Howard of American Media, 
Inc. (“AMI”), the publisher of the National Enquirer^ Trump, and Hope Hicks, who was then 
press secretary for Trump’s presidential campaign. Based on the timing of these calls, and the 
content of the text messages and emails, I believe that at least some of these communications 
concerned the need to prevent Clifford from going public, particularly in the wake of the Access 
Hollywood story. In particular, I have learned the following: 

a. On October 8,2016, at approximately 7:20 p .m., Cohen received a call from Hicks. 
Sixteen seconds into the call. Trump joined the call, and the call continued for over four minutes.® 
Based on the toll records that the US AO has obtained to date, I believe that this was the first call 
Cohen had received or made to Hicks in at least multiple weeks, and that Cohen and Trump spoke 
about once a month prior to this date - specifically, prior to this call on October 8, 2016, Cohen 
and Trump had spoken once in May, once in June, once in July, zero times in August, and twice 
in September. 

b. Approximately ten minutes after the call ended, Hicks and Cohen spoke again for 
about two minutes. 


’ Pecker is President of AMI and, according to his own statements in public reports, a personal 
friend of Trump. Howard is the chief content officer of AMI, who according to public records 
reports directly to Pecker. 

® I believe that Trump joined the call between Cohen and Hicks based on my review of toll 
records. Specifically, I kn ow that a call was ini tiated between Cohen’s telephone number and 
Trump’s telephone number at the same time the records indicate that Cohen was talking to Hicks. 
After the Cohen-Trump call was initiated, it lasted the same period of time as the Cohen-Hicks 
call. Additionally, the toll records indicate a “-1” and then Trump’s telephone number, which, 
based on my training and experience, means that the call was either transferred to Trump, or that 
Trump was added to the call as a conference or three-way call participant. In addition, based on 
my conversations with an FBI agent who has interviewed Hicks, I have learned that Hicks stated, 
in substance, that to the best of her recollection, she did not learn about the allegations made by 
Clifford until early November 2016. Hicks was not specifically asked about this three-way call. 


10 
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c. At 7:39 p.m., immediately after the second call with Hicks ended, Cohen called 
David Pecker (as noted above, the President of American Media Inc., or AMI) and they connected 
for thirty seconds. Approximately four minutes later, Cohen called Pecker again and they spoke 
for more than a minute. Three minutes after ending his call with Pecker, Cohen received a call 
from Dylan Howard (as noted above, the Chief Content Officer of AMI), and they spoke for 
approximately a minute. According to toll records, it does not appear that Cohen and Howard 
spoke regularly prior to October 8, 2016, as it had been over a month since they had called each 
other. 

d. At 7:56 p.m., approximately eight mmutes after his call with Howard ended, Cohen 
called Hicks and they co nn ected for two minutes. At approximately the same time this call ended, 
Cohen received a call from Pecker, and they spoke for about two minutes. At 8:03 p.m., about 
three minutes after ending his call with Pecker, Cohen called Trump, and they spoke for nearly 
eight minutes. 

e. At 8:39 p.m. and 8:57 p.m., Cohen received calls from Howard and spoke to him 
for about four and sis minutes, respectively. At 9:13 p.m., about ten minutes after Cohen and 
Howard hung up from the second of these calls, Howard sent Cohen a text message that said: 
“Keith will do it. Let’s reconvene tomorrow.” Based on my involvement in this investigation, I 
beheve that when Howard vwote “Keith,” he was referring to Keith Davidson, the attorney for 
Stephanie Clifford. At 3:31 a.m., now on October 9, 2016, Cohen sent Howard a text message in 
response that said: “Thank you.” Eight minutes later, Cohen sent Howard a text message that said: 
“Resolution Consultants LLC. is the name of the entity I formed a week ago. Whenever you wake, 
please call my cell.” 


11 
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I 

I 

f. The following day, on October 10,2016,. at 10:58 a.m., Howard sent a text message | 

to Cohen and Davidson, which stated: “Keith/Michael: connecting you both in regards to that 
business opportunity. Spoke to the client this AM and they’re confirmed to proceed with the 
opportunity. Thanks. Dylan. Over to you two.” At 12:25 p.m., Davidson sent Cohen a text message 
that stated: “Michael — if we are ever going to close this deal — In my opinion, it needs to be today. 

Keith.” Davidson and Cohen then spoke by phone for about three minutes. Based on my 
participation in this investigation, I believe that when Howard wrote that the “chent” was 
“confirmed to proceed with the opportunity,” he was referring to Clifford’s agreement in principle 
to accept money from Cohen in exchange for her agreement not to discuss any prior affair with 
then-candidate Trump.^ 

g. Based on my review of records obtained pursuant to the Cohen Email Warrants, I 
kn ow that on or about October 10,2016, Clifford and Davidson appear to have signed a “side letter 
agreement” that stated it was an exhibit to a “confidential settlement agreement and mutual 
release” between “Peggy Peterson” and “David Dennison.” The purpose of the document, 
according to the agreement, was to define the “true name and identity” of persons named by 
pseudonym in “confidential settlement agreement and mutual release.” The side letter agreement 
specifies the identity of “Peggy Peterson” to be Clifford, but the space for “Dennison’s” identity 
is blank. The agreement also includes a signature page for “Peterson,” “Dennison,” and their 
attorneys. The signature page is signed by “Peterson” and his attorney, Davidson, but the 

^ As set forth below, AMI was also involved in a payment to model Karen McDougal. 

However, because these communications were in close temporal proximity to the events involving 
the negotiation of a pa)mient to Clifford, the execution of the agreement with Clifford, and the 
payment of money to Clifford, I believe that these communications were related to Clifford. 

Additionally, based on my review of public statements by McDougal, I have learned that she 
negotiated an agreement with AMI several months prior to these communications between Cohen 
and Pecker, Howard, and Davidson. 
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document is unsigned by “Dennison” and his attorney. Based on my involvement in this 
investigation, I believe that Davidson sent Cohen this partially-signed “side letter agreement” in 
order to facilitate the closing of a deal between Davidson’s client and Cohen or his client on 
October 10, 2016. 

19. It appears that on October 13, 2016, and the days that followed, Cohen took steps 
to complete a transaction with Davidson, including attempting to open an account from which 
Cohen could transfer funds to Davidson. Specifically, from my review of toll records, information 
obtained pursuant to the iCloud Warrant and Cohen Email Warrants, records maintained by First 
Republic, as well as my participation in interviews with First Republic employees, I have learned 
the following: 

a. On the mo rnin g of October 13,2016, at 8:54 a.m., Cohen sent Pecker a text message 
that stated: “I need to talk to you.” At 9:06 a.m.. Pecker sent a text message to Cohen that stated, 
“I called please call me back.” The tolls between Cohen and Pecker do not show a telephone call 
between 8:54 a.m. and 9:06 a.m. However, based on my review of text messages, I have learned 
that Cohen and Pecker communicate with each other over Signal, which is an encrypted 
communications cellphone application that allows users to send encrypted text messages and make 
encrypted calls. 

b. At 9:23 a.m., Cohen sent an email that stated “call me” to a banker at First Republic 
Bank (“First Republic Employee-2”). The email attached documents from the Secretary of State 
of Delaware indicating that Cohen had formed a limited liability company called “Resolution 
Consultants EEC” on September 30,2016. As noted above, “Resolution Consultants” is the name 
of the entity that Cohen had told Howard he had formed recently after Howard said Davidson 
would “do it.” At 10:44 a.m., Cohen called First Republic Employee-2 and told him, in sum and 
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substance, that he needed an account in the name of “Resolution Consultants” opened immediately, 
and that he did not want an address on the checks written out of the account. Later that day, another 
employee at First Republic emailed Cohen account opening paperwork to complete. Cohen 
returned the account opening documents partially completed, but failed to provide a copy of his 
driver’s license or passport, and did not respond to the employee’s question of how he wanted to 
fund the accoimt. As a result, the account was never opened. 

c. On October 17,2016, Cohen incorporated Essential Consultants LLC in Delaware. 
That same day, he filed paperwork to dissolve Resolution Consultants LLC. 

20. Despite these steps taken by Cohen, it appears that the negotiation between Cohen 
and Davidson was not progressing sufficiently fast enough for Davidson or his client, Clifford, 
and they threatened to go public with Clifford’s allegations just days before the presidential 
election. Specifically, based on my review of toll records, information obtained pursuant to the 
iCloud Warrant, and public sources, I loiow the following: 

a. According to an article in The Washington Post, which quoted emails sent from 
Cohen’s email account hosted by the Trump Organization, on October 17,2016, Davidson emailed 
Cohen and threatened to cancel the aforementioned “settlement agreement” by the end of the day 
if Cohen did not complete the transaction. According to the article, Davidson sent Cohen a 
second email later in the day that stated in part, “Please be advised that my client deems her 
settlement agreement canceled and void.” At 4:00 p.m. that day, Cohen called Davidson and they 
spoke for over five minutes. 


Due to the partially covert nature of the investigation to this date, the Government has not 
requested documents from the Trump Organization or Davidson, and thus does not possess the 
email referenced in this article. 
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b. Cohen’s 4:00 p.m. call with Davidson and/or Davidson’s threats to cancel the 
“settlement agreement” appear to have touched off a flurry of communications about the settlement 
agreement and whether Clifford would go public. Specifically: 

i. At 4:43 p.m., Howard sent Cohen a text message that stated: “I’m told 

they’re going with DailyMail. Are you aware?” One minute later, Cohen responded: “Call me.” 
Based on my involvement in this investigation, I understand Howard’s text to mean that he heard 
that Clifford was going to take her story of an extramarital affair with Trump to the Daily Mail, a 
tabloid newspaper. 

ii. At 4:45 p.m., Howard called Cohen and they spoke for over two minutes. 
Moments later, Davidson and Cohen spoke for about two minutes. 

iii. At 5:03 p.m., Cohen attempted to call Trump, but the call only lasted eight 
seconds. This was Cohen’s first call after he spoke with Davidson. 

iv. At 5:25 p.m., Cohen texted Howard, stating: “Well???” 

v. At 6:44 p.m., Howard responded to Cohen’s text, stating: “Not taking my 
calls.” Cohen responded one minute later: “You’re kidding. Who are you trying to reach?” 
Howard responded one minute later: “The ‘agent.’” Based on my involvement in this 
investigation, I understand Howard’s text messages to mean that he attempted to contact Davidson 
about the matter involving Clifford, but that Davidson was not taking Howard’s calls. 

vi. At 6:49 p.m., Cohen called Howard and they spoke for nearly four minutes. 

c. The following day, on October 18, 2016, TheSmokingGun.com, a website that 
publishes legal documents and mugshots, published an article called: “Donald Trump and the Pom 
Superstar,” which alleged that Trump had an extramarital affair with Clifford. However, the 
article noted that Clifford had declined to comment. 


15 










Case l:18-cr-00602-WHP Document 48-6 Filed 07/18/19 Page 20 of 80 


21. On or about October 25, 2016, the communications between Cohen, Davidson, 
Howard and Pecker picked up again, apparently concerning a transaction involving Clifford. 
Specifically, based on my review of toll reeords, information obtained pursuant to the Cohen Email 
Warrants and iCloud Warrant, as well as my review of publie sources, I have learned the following: 

a. On Oetober 25, 2016, at 6:09 p.m., Howard sent Cohen a text message stating: 
“Keith r ailing you urgently. We have to eoordinate something on the matter he’s calling you about 
or its [sic] could look awfully bad for everyone.” One minute later, Davidson sent Cohen a text 
message stating “Call me.” Cohen and Davidson called eaeh other several times over the next half 
hour but appear not to have eonneeted. At 6:42 p.m., Cohen and Davidson spoke for about eight 
minutes. At 7:11 p.m., they spoke for another two minutes. 

b. The next morning, on or about Oetober 26,2016, at 8:26 a.m., Cohen called Trump 
and spoke to him for approximately three minutes. At 8:34 a.m., Cohen ealled Trump again and 
connected for a minute and a half. 

c. At approximately 9:04 a.m.—^less than thirty minutes after speaking with Trump— 
Cohen sent two emails to the person who had ineorporated Resolution Consultants and Essential 
Consultants for him, and stated “can you send me asap the filing reeeipt” and then, in the second 
email, “for Essential Consultants EEC.” That person responded with the filing receipt two minutes 
later at 9:06 a.m. and with the certification of formation 23 minutes later, at 9:27 a.m. 

d. Shortly after that, Cohen contacted First Republic Employee-2 and told him, in sum 
and substance, that he deeided not to open an account in the name of “Resolution Consulting” and 
instead would be opening a real estate consulting company in the name of “Essential Consultants.” 
Cohen told First Republic Employee-2 that he was at Trump Tower, and wanted to go to a First 
Republic branch across the street to open the aeeount, so First Republic Employee-2 called, a 
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preferred banlcer at that branch (“First Republic Employee-1”), to assist Cohen. At 11:00 a.m., 
First Republic Employee-1 called Cohen. I know from my participation in an interview with First 
Republic Employee-1, that around the time of the call he went to Cohen’s office in Trump Tower— 
on the same floor as the Trump Organization—and went through account opening questions, 
including know your customer questions, with Cohen. In response to a series of know-your- 
customer questions about the purpose of the account—^the answers to which First Republic 
Employee-1 entered into a form—Cohen stated, in sum and substance, that he was opening 
Essential Consultants as a real estate consulting company to collect fees for investment consulting 
work, and all of his consulting clients would be domestic individuals based in the United States. 
Based on my review of records obtained from First Republic, it appears that this account (the 
“Essential Consultants Account”) was created at a time between 11:00 a.m. and 1:00 p.m. 

e. At 1:47 p.m., Cohen called Davidson and they spoke for approximately two 
minutes. At approximately 1:49 p.m., Davidson emailed Cohen wiring instructions for an attorney 
client trust account at City National Bank. 

f. After the Essential Consultants Account was opened on October 26, 2016, Cohen 
transferred $131,000 from a home equity line of credit that Cohen had at First Repubhc to the 
Essential Consultants Account. Following the transfer, at approximately 4:15 p.m. on October 26, 
2016, First Republic Employee-2’s assistant emailed Cohen at his Trump Organization email 
address to tell him that the funds had been deposited into the Essential Consultants Accoimt. 
Cohen forwarded that email to the Cohen Gmail Account and then forwarded it to Davidson. 

g. At 6:37 p.m., Cohen asked Pecker by text message, “Can we speak? Important.” 
Cohen called Pecker at 6:49 p.m. and connected for thirty seconds. At 6:57 p.m., Cohen sent 
Howard a text message, stating: “Please call me. Important.” Cohen called Howard at 7:00 p.m. 
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and connected for about thirty seconds. At 7:06 p.m., Cohen called Peckerjagain and they spoke 
for nearly thirteen minutes. At 7:24 p.m., Howard sent a text message to Cohen that: “He said 
he’d call me back in 20 minutes. I told him what you are asldng for his [sic] reasonable. I’ll get 
it sorted.” Approximately an hour later, at 8:23 p.m., Howard told Cohen by text message to 
“check your Gmad for email from my private accoimt.” In an email sent at 8:23 p.m. by Howard 
to Cohen and Davidson, with the subject line “Confirmation,” Howard stated, “Thank you both 
for chatting with me earlier. Confirming agreement on: - Executed agreement, hand-signed by 
Keith’s chent and returned via overnight or same-day FedEx to Michael, - Change of agreement 
to reflect the correct EEC, - Transfer of funds on Thursday AM to be held in escrow until receipt 
of agreement.” After receiving that email, at approximately 8:27 p.m., Cohen asked Howard by 
text message, “Can you and David [Pecker] give me a call.” Howard promptly responded: “David 
is not around I think. I’ll call.” At 8:28 p.m., Howard called Cohen and they spoke for three 
minutes. 

22. On October 27, 2016, Cohen made a payment to Davidson of $130,000—with the 
funds intended for Clifford—for the purpose of securing her ongoing silence with respect to the 
allegations that she had an extramarital affair with Trump. Specifically, based on my review of 
toll records, bank records, and information obtauied pursuant to the iCloud Warrant and Cohen 
Email Warrants, I have learned the following: 

a. At 9:47 a.m., Cohen sent Davidson an email, stating: “Keith, kindly confirm that 
the wire received today, October 27, 2016 shall be held by you in your attorney’s trust accoimt 
imtil such time as directed for release by me, in writing. Additionally, please ensure that all 
paperwork contains the correct name of Essential Consultants EEC. I thank you in advance for 
your assistance and look forward to hearing from you later.” 
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b. At approximately 10:01 a.m., according to records provided by First Republic 
Bank, Cohen completed paperwork to wire $130,000 from the Essential Consultants Account— 
which had been fimded a day prior from Cohen’s home equity line of credit—^to the attorney client 
trust account at City National Bank that Davidson had specified in the wiring instructions he sent 
to Cohen. The wire transfer was made shortly thereafter. 

c. At 10:02 a.m., Davidson responded to Cohen’s email from 9:47 a.m., stating: “I 
confirm that I will work in good faith & that no funds shall be disbursed unless & until the plaintiff 
personally signs all necessary settlement paperwork, (the form of which will match the prior 
agreement). The settlement docs will name the correct corporation, (Essential Consultants LLC). 
Plaintiffs signature will be notarized and returned to you via FedEx. Only after you receive FedEx 
will I disburse. Fair?” 

d. At 10:50 a.m.. First Republic Employee-1 sent Cohen an email confirming that the 
payment had been sent and providing him with the wire number. 

23. On October 28, 2016, and the days that followed, Cohen finalized the transaction 
with Davidson. Specifically, based on my review of toll records, information obtained pursuant 
to the iCloud Warrant, public sources, and bank records, I know the following: 

a. On October 28,2016, at 11:48 a.m., Cohen spoke to Trump for approximately five 
minutes. Beginning at 1:21 p.m., Cohen attempted a series of phone calls to Davidson, Pecker, 
and Howard throughout the day, although it appears he may only have connected with Howard. 

b. Later that day, at approximately 7:01 p.m., Davidson stated to Cohen by text 
message that “all is AOK. I should have signed, notarized docs on Monday. You should have 
them on Tuesday.” Cohen thanked hi m and said “I hope we are good.” Davidson responded, “I 
assure you. We are very good.” Howard also texted Cohen at 7:08 p.m., “Keith [Davidson] says 
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we are good.” Cohen then responded “OK” to Howard and “Excellent” to Davidson. At 
approximately 10:30 p.m., Cohen spoke to Hicks for three minutes. 

c. On October 31, 2016, Cohen called Howard at 8:22 p.m. and they spoke for over 
three minutes. At 8:32 p.m., Cohen received text messages from both Howard and Davidson. 
Howard said: “You’ll have paperwork tomorrow says KD.” Davidson said: “We are AOK. You 
will be receiving a package tomorrow.” Cohen responded “Thank you” to Howard and “Thanks 
Keith. Will call you then” to Davidson. From my involvement in this investigation, I believe 
Davidson was referring to a signed nondisclosure agreement when he told Cohen that he would 
receive a package. 

d. Based on my review of court filings that became public in 2018,1 have learned that 
on or about October 28, 2016, “EC, LLC and/or David Dennison” entered into a “confidential 
settlement agreement and mutual release” with “Peggy Peterson,” pursuant to which “Peterson” 
agreed not to disclose certain “confidential information pertaining to [Dennison]” in exchange for 
$130,000. The agreement provided that “EC, LLC” would wire the funds to “Peterson’s” attorney, 
who would then transfer funds to “Peterson.” Cohen signed the agreement on behalf of “EC, 
LLC.” The agreement stated that the address for “EC, LLC,” which was later referred to in the 
agreement as “Essential Consultants, LLC,” was Cohen’s residence. 

e. Consistent with the “confidential settlement agreement and mutual release,” on or 
about November 1, 2016, Davidson transferred $96,645 from his attorney client trust account at 
City National Bank to a hank account in Clifford’s name. The wire had the annotation “net 
settlement.” On the same day, at approximately 9:48 a.m. Davidson sent Cohen a text message 
with a picture of a FedEx delivery confirmation, stating that at approximately 9:09 a.m. a package 
shipped by Davidson the previous day had arrived for Cohen at his Trump Organization 
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address. On the same day, at approximately 6:14 p.m., Davidson sent Cohen an email with an 
audio file attached and said “Give this a lesson [sic] and then call me.” The audio attachment was 
titled “Stormy.mp3” and was a five-minute recording of Davidson interviewing Clifford about 
recent public allegations made by an adult film star named Jessica Drake regarding her alleged 
past affair with Trump; in the recording, Clifford explained the reasons she believed that Drake 
was not credible. Less than an hour later, at approximately 7:05 p.m., Cohen called Trump, but it 
appears that they did not connect. Cohen then called a telephone number belonging to Kellyanne 
Conway, who at the time was Trump’s campaign manager. They did not connect. At 
approximately 7:44 p.m., however, Cohen received a return call from Conway, which lasted for 
approximately six minutes. 

24. On November 4,2016, just three days after the Clifford transaction was completed 
and just four days before the presidential election, the Wall Street Journal published an article 
alleging that the National Enquirer had “Shielded Donald Trump” from allegations by Playboy 
model Karen McDougal that she and Tmmp had an affair. The article alleged that AMI had agreed 
to pay McDougal to bury her story. McDougal, like Clifford, had been represented by Davidson. 
Based on my review of toll records, information obtained pursuant to the Cohen Email Warrants 
and iCloud Warrant, and public sources, it appears that Cohen spoke frequently to Davidson, 
Howard, Pecker, and Hicks around the time of this article’s publication—just days before Election 
Day—^about the importance of preventing the McDougal and Clifford stories from gaining national 
traction. Specifically, I have learned the following: 

a. Between 4:30 and 8:00 p.m. on November 4, Cohen communicated several times 
with Howard, Pecker and Davidson. For instance, at approximately 4:49 p.m., Cohen sent Howard 
a text message with a screenshot of an email forwarded to him by another Trump Organization 
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lawyer. The forwarded email was from a Wall Street Journal reporter, and asked for comment 
from Trump and/or the campaign on the story. Cohen also spoke with Hicks several times, 
including shortly before and/or after calls with Pecker, Howard and Davidson. Indeed, at 
approximately 7:33 p.m., using two different cellphones subscribed to him, Cohen appears to have 
been talking to Davidson and Hicks at the same time. 

b. At approximately 8:51 p.m., Cohen sent Howard a message, stating: “She’s being 
really difficult with giving Keith a statement. Basically went into hiding and unreachable.” One 
minute later, Howard responded: “I’ll ask him again. We just need her to disappear.” Cohen 
responded, “She definitely disappeared but refuses to give a statement and Keith cannot push her.” 
At approximately 8:55 p.m., Howard responded to Cohen’s text: “Let’s let the dust settle. We don’t 
want to push her over the edge. She’s on side at present and we have a solid position and aplausible 
position that she is rightfully employed as a columnist.” Based on my involvement in this 
investigation, I believe Cohen and Howard were referring to Karen McDougal when they were 
discussing “she” and “her.” Additionally, I believe Howard’s statement that “we have ... a 
plausible position that she is rightfully employed as a colunmist” was a reference to the fact that 
AMI had given McDougal payments for her role as a purported columnist for the company. 

c. At approximately 8:58 p.m. on November 4, 2016, Howard attempted to reassure 
Cohen about the effect of the forthcoming Wall Street Journal article, texting, “I think it’ll be ok 
pal. I think it’ll fade into the distance.” Cohen responded, “He’s pissed.” Howard wrote back, 
“I’m pissed! You’re pissed. Pecker is pissed. Keith is pissed. Not much we can do.” Based on 
my involvement in this investigation, I believe Cohen was referring to Trump when he stated “he’s 
pissed.” Cohen asked Howard at approximately 9:00 p.m. how the Wall Street Journal could 
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publish its article if “everyone denies.” Howard responded, “Because there is the payment from 
AMI. It looks suspicious at best.” 

d. At approximately 9:03 p.m., Hicks called Cohen and they spoke for two minutes. 
At approximately 9:11 p.m., Cohen called Howard and spoke to him for five minutes. At 
approximately 9:15 p.m., Hicks called Cohen and they spoke for nearly seven minutes. Again, 
Cohen used different phones for these two calls, such that he appears to have been on both calls 
for about a minute of overlap. At approximately 9:32 p.m., Cohen texted Pecker, “The boss just 
tried calling you. Are you free?” A min ute later, Cohen texted Howard, “Is there a way to find 
David quickly?” 

e. At approximately 9:50 p.m., the Wall Street Journal article was published online. 
Howard and Hicks both sent web links for the article to Cohen. Over the next half hour, Cohen 
and Howard exchanged several text messages commenting on how the story came across. The next 
morning onNovember 5,2016, at approximately 7:35 a.m., Cohen texted Hicks, “So far I see only 
6 stories. Getting little to no traction.” Hides responded, “Same. Keep praying!! It’s working!” 
Cohen wrote back, “Even CNN not talking about it. No one believes it and if necessary, I have a 
statement by Storm denying everything and contradicting the other pom stars statement. I wouldn’t 
use it now or even discuss with him as no one is talking about this or cares!” Based on my 
involvement in this investigation, I believe Cohen was referring to the above-referenced recorded 
audio statement by Clifford that he obtained from Davidson, and was stating that such a statement 
could be used to influence potential negative media relating to Trump, but was unnecessary at that 
time. Based on a text message from Hicks to Cohen, I believe that later that morning. Pecker 
spoke to Trump. 
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25. On or about November 8,2016, Trump won the election for President of the United 

States. 

26. On or about January 12, 2018, the Wall Street Journal first reported that Cohen 
arranged a payment to Clifford. On or about January 22, 2018, Common Cause, a government 
watchdog group, filed a complaint with the Federal Election Commission, alleging that Cohen had 
violated campaign finance laws by making the payment to Clifford. Based on my review public 
sources following that report, as well as emails obtained pursuant to the Cohen Email Warrants, I 


have learned the following: 

a. On or about January 23, 2018, the day after Common Cause filed its complaint, 

Cohen began emailing himself drafts of statements describing his payment to Clifford. 

Additionally, on January 23, 2018, Cohen emailed the following draft of that statement to an 

individual who appears to be writing a book on Cohen’s behalf: 

In October 2016,1 was contacted by counsel for Ms. Clifford stating that 
news outlets, including ABC news, were pursuing the 2011 story of an 
alleged affair between Mr. Trump and Ms. Clifford. Despite the fact that 
both parties had already denied the allegation, as Mr. Trump’s longtime 
special counsel and protector, I took it upon myself to match the offer and 
keep the story from brealdng. I loiew the allegation to be false, but I am 
also a realist who understands that just because something is false doesn ’t 
mean that it doesn’t create harm and damage. I could not allow this to 
occur. I negotiated a non-disclosure agreement with Ms. Clifford’s 
counsel and tendered the fhnds. I did this through my Delaware EEC and 
transferred personal funds to cover the agreement. I was not reimbursed 
any monies from Mr. Trump, the Trump Organization, any third party or 
the Presidential campaign. At no point did I ever advise Mr. Trump of my 
communications or actions regarding this agreement. As outlandish and 
unusual as this may appear, the Trumps have been like family to me for 
over a decade. It’s what you do for family. 

(Emphasis added.) Based on my involvement in this investigation, I believe that the above email 
is an acknowledgement that the allegation of the affair had existed for some time ("\..the 2011 
story.. .”), but that Cohen was motivated to “keep the story ftom breaking” again in October 2016. 
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b. On or about February 13, 2018, Cohen said in a statement to The New York Times f 

I 

I 

that “Neither the Trump Organization nor the Trump campaign was a party to the transaction with j 

Ms. Clifford. The payment to Ms. Clifford was lawful, and was not a campaign contribution or a ' 

campaign expenditure by anyone.” Cohen declined to answer follow-up questions including r 

whether Trump had been aware of the payment, why Cohen made the payment, or whether similar f 

payments had been made to other people. 

c. On or about February 14, 2018, Cohen was asked by The New York Times whether 

Trump had reimbursed bim, whether he and Trump had made any arrangement at the time of the I, 

I 

, . ^ 
payment, or whether he had made payments to other women. Cohen stated m response, “I can’t I 

get mto any of that.” On or about February 14, 2018, Cohen also stated to The Washington Post 

that: “In a private transaction in 2016, I used my own personal funds to facilitate a payment of 

I 

$130,000 to Ms. Stephanie Clifford. Neither the Trump Organization nor the Trump campaign ' 

was a party to the transaction with Ms. Clifford, and neither reimbursed me for the payment, either | 

directly or mdirectiy.” 

d. On or about March 9, 2018, Cohen stated to ABC News that “the funds were taken 

from my home equity line and transferred internally to my LLC account in the same bank.” : 

27. Accordingly, for the foregoing reasons, there is probable cause to believe that ! 

Cohen committed violations of the Subject Offense by making an in-kind contribution to Trump 
or the Trump campaign in the form of a $130,000 payment to Clifford on the eve of the election. 

Indeed, while he denies having given an unlawful contribution, in bis own statements Cohen has i 

admitted that he paid $130,000 of his “personal funds” to Clifford and that the payment occurred ! 

less than two weeks before the election, as Trump was facing negative media allegations about 5 

f 

his behavior toward women, even though allegations of an affair between Trump and Clifford t 
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existed since 2011. In addition, the communication records set forth above make evident that 
Cohen communicated with members of the Trump campaign about his negotiation with 
Clifford’s attorney and the need to preclude Clifford from making a statement that would have 
reflected negatively on the candidate in advance of the forthcoming election. 

28. Therefore, there is probable cause to believe that a search of the Subject Devices 
will reveal evidence, fruit and instrumentalities of the Subject Offenses, including the following: 

a. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or 
their agents or legal representatives, including any nondisclosure agreements and related 
documents, and any communications related to such agreements. 

b. Evidence of communications involving Michael Cohen, Donald Trump 
and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, 
or payments to Stephanie Clifford or Karen McDougal. 

c. Evidence of communications with American Media, Inc., David Pecker, 
and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or 
Karen McDougal. 

d. Evidence relating to Cohen’s role in the Trump Campaign, and coordination 
or consultation with the Trump Campaign. 

e. Evidence of communications with Donald Trump and/or agents or 
associates of the Trump Campaign about the Access Hollywood tape. 

f. Evidence relating to Cohen’s knowledge of the campaign finance laws, 
campaign contribution reporting requirements, and campaign contribution limits. 
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g. Evidence indicating Michael Cohen’s intent with respect to the Subject 
Offense, including whether the payment to Clifford and any similar payments were made to 
influence the Presidential election. 

in. Procedures for Searching ESI 
A. Review of ESI 

29. Law enforcement personnel (including, in addition to law enforcement officers and 
agents, and depending on the nature of the ESI and the status of the investigation and related 
proceedings, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, interpreters, and outside vendors or technical experts under 
government control) will review the ESI contained on the Subject Devices for information 
responsive to the warrant. 

30. In conducting this review, law enforcement personnel may use various methods to 
locate evidence, fruits, and instramentalities of the Subject Offense, including but not lunited to 
undertakmg a cursory inspection of all emails, texts or files contained on the Subject Devices. This 
method is analogous to cursorily mspecting all the files in a file cabinet in an office to determine 
which paper evidence is subject to seizure. Although law enforcement personnel may use other 
methods as well, particularly including ke 3 word searches, I know that ke 5 word searches and 
similar methods are typically inadequate to detect all information subject to seizure. As an initial 
matter, ke)word searches work only for text data, yet many types of files commonly associated 
with emails, including attachments such as scanned documents, pictures, and videos, do not store 
data as searchable text. Moreover, even as to text data,, ke 5 word searches cannot be relied upon 
to capture all relevant communications in an account, as it is impossible to know in advance all of 
the unique words or phrases that investigative subjects will use in their communications, and 
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consequently there are often many co mm unications in an accoimt that are relevant to an 
investigation but that do not contain any keywords that an agent is likely to search for. 

IV. Conclusion and Ancillary Provisions 

31. Based on the foregoing, I respectfully request the court to issue a warrant to seize 
the items and information specified in Attachment A to this affidavit and to the Search and Seizure 
Warrant. 

32. In light of the confidential nature of the continuing investigation, and for the 
reasons more fully set forth in the Accompanying Affidavit, I respectfully request that this affidavit 
and all papers submitted herewith be maintained under seal until the Court orders otherwise. 



Special Agent, USAO 


Sworn to before me on 


7th day of April, 20,1, S : 111 ,, 


HON. HENEY,B- PliAPN v i V 
UNTTEDi SiAir^hy.GIS;MTE JUDGE 



i 
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Attachment A 

I. Devices to be Searched 

The devices to be searched (the “Subject Devices”) are described as: 

a. Subject Device-1: A black and red USB drive with a white label that says “Tracking 
#: 180208140208.” 

b. Subject Device-2: A silver DVD with a white label that reads “Cohen — 
2018.03.07.” 

c. Subject Device-3: A white DVD labelled “2-28-18 Cohen SW Returns — Google 

and l&l.”...... - - 


n. Review of ESI on the Subject Devices 

Law enforcement personnel (including, in addition to law enforcement officers and agents, 
and depending on the nature of the ESI and the status of the investigation and related proceedings, 
attorneys for the government, attorney support staff, agency personnel assisting the government in 
this investigation, interpreters, and outside vendors or technical experts under government control) 
are authorized to review the ESI contained on the Subject Devices for evidence, fruits, and 
instrumentalities of one or more violations of 52 U.S.C. §§ 30116(a)(1)(A) and 30109(d)(l)(A)(l) 
(illegal campaign contributions) (the “Subject Offense”), as listed below: 

a. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their 
agents or legal representatives, including any nondisclosure agreements and related 
documents, and any communications related to such agreements. 

b. Evidence of communications involving Michael Cohen, Donald Trump and/or 
agents or associates of the Trump Campaign about Stephanie Clifford or Karen 
McDougal, or payments to Stephanie Clifford or Karen McDougal. 

c. Evidence of communications with American Media, Inc., David Pecker, and/or 
Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, 
and/or Karen McDougal. 

d. Evidence relating to Cohen’s role in the Trump Campaign, and coordination or 
consultation with the Trump Campaign. 
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e. Evidence of communications with Donald Trump and/or agents or associates of the 
Trump Campaign about the Access Hollywood tape. 

f. Evidence relating to Cohen’s knowledge of the campaign finance laws, campaign 
contribution reporting requirements, and campaign contribution limits. 

g. Evidence indicating Michael Cohen’s intent with respect to the Subject Offense, 
including whether the payment to Clifford and any similar payments were made to 
influence the Presidential election. 
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Exhibit A 
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AO 93 (Rev, 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 


KiEP 

21 201 ? 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 

INFORMATIO N ASSOCIATED WITH THE EMAIL 
ACCOUNT^^^^^HmGiVIAILCOM 


Assl9neaTo:H8we«,BerylA. 

an. seizure warrant 


SEARCH AND SEIZURE WARRANT 


I 


JTo:-An 3 cauthorized-law-enfbrcement-of£icer--. . - 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of _ California 

(identify the person or describe the property to be searched and give its location)^ 


See Attachment A. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

See Attachment B, 


YOU ARE COMMANDED to execute this warrant on or before August 1,2017 (not to exceed 14 days) 

^ in the daytime 6:00 a.m. to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the propeity taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to . Hon, BoryjA, Howell . . 

(United States Magistrate Judge) 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C* 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
propeily, will be searched or seized (check the appropriate box) 

□ for_days f>7o/ to exceed30) □ until, the facts justifying, the later specific date of _ . _, 

Date and time issued: f ^ 

^ Judge's signature 

City and state: VVashington, DO Hon. Beryl A. Howell, Chief U.S. District Judge 

^ Printed name and title 
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AO 93 (Rev 11/13) Search and Seizure Warranl (Page 2) 


Return 


Case No.: 

i7-r.c^ 


Date and tinp warrant executed: 

yjih/'zon 


Inventory made in the presence of: 


Copy of warrant and inventory left with: 


Inventory of the property taken and name of any person(s) seized: 


I \^c>e>6<^ 7^01707\q~ j 

V/CC/--A Prod^-^^- F,4r 


FILE© 

JUL 21 2017 

ClOTfe, u.s. District and 
Bankruptcy Courts 


Certifleuttou 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Dale: 


; /T^nepo 



l-'runed mtme cuKi fiKe 



























Case l:18-cr-00602-WHP Document 48-6 Filed 07/18/19 Page 38 of 80 


ATTACHMENT A 


This warrant applies to information associated with the Google Mail Account 
l@gmail.com that is stored at premises owned, maintained, controlled, or operated by 
Google, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043. 



1 
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ATTACHMENT B 


L Information to be disclosed by Google 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Google (hereinafter “the Provider”), regardless of whether such 
information is stored, held or maintained inside or outside of the United States, and including any 
emails, records, files, logs, or information that have been deleted but are still available to the 
Provider, the Provider is required to disclose the following information to the government for each 
account or identifier listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, 
the IP address used to register the account, log-in IP addresses associated with 
■session times and dates, account status, alternative e-mail addresses provided 
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during registration, all other user names associated with the account, all account 
names associated with the subscriber, methods of connecting; 

f. All search history or web history; 

g. All records indicating the services available to subscribers of the accounts; 

h. All usernames associated with or sharing a login IP address or browser cookie with 
the accounts; 

i. All cookies, including third-party cookies, associated with the user; 

j. All records that are associated with the machine cookies associated with the user; 

and...... 

k. All telephone or instrument numbers associated with the Account (including MAC 
addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity 
Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile Identification 
Numbers (“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”), International Mobile 
Subscriber Identifiers (“IMSI”), or International Mobile Equipment Identities 
(“IMEI”). 

II. Information to be Seized by the Government 

All infoimation described above in Section I that constitutes evidence, contraband, fruits, 
and/or instrumentalities of violations of 18 U.S.C. § 1014 (false statements to a financial 
institution) and 18 U.S.C. § 1956 (money laundering), as well as 18 U.S.C. § 951 (acting as an 
unregistered foreign agent) and the Foreign Agents Registration Act (“FARA”), 22 U.S.C. § 611 
etseq., involving Michael Dean Cohen and occurring on or after January 1, 2016, including, for 
each account or identifier listed on Attachment A, information pertaining to the following matters; 

a. Communications, records, documents, and other files involving Essential 
Consultants, EEC; 

b. Communications, records, documents, and other files involving Bo and Abe Realty, 
EEC; 

c. Communications, records, documents, and other files that false representations to a 
financial institution with relation to intended the purpose of an account or loan at 
that financial institution; the nature of any business or entity associated with an 


3 






Case l:18-cr-00602-WHP Document 48-6 Filed 07/18/19 Page 41 of 80 


account a financial institution; the source of funds flowing into an account; or the | 

purpose or nature of any financial transactions involving that financial institution; | 

d. Records of any funds or benefits received by or offered to Michael Dean Cohen by, 

I 

or on behalf of any foreign government, foreign officials, foreign entities, foreign 

j 

persons, or foreign principals; j 

e. Communications, records, documents, and other files that reveal efforts by Michael 
Dean Cohen to conduct activities on behalf ofi for the benefit of, or at the direction 

of any foreign government, foreign officials, foreign entities, foreign persons, or j 

I 

foteign priacjpals;..-...... 

f. Evidence indicating how and when the account was accessed or used, to determine 1 

the geographic and chronological context of account access, use, and events relating | 

to the crimes under investigation and to the account owner; | 

g. Evidence indicating the account owner’s-state of mind as it relates to the crimes jj 

under investigation; | 

h. The identity of the person(s) who created or used the account, including records j 

that help reveal the whereabouts of such person(s); and 

i. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—^who communicated with the account about any matters relating 
to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or 
at the direction of any foreign government, foreign officials, foreign entities, 
foreign persons, or foreign principals. 
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Exhibit B 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for tlie 

District ofColumbia 

Case: 1:17-mj-OO805 
Assigned To : Chief Judge Howell, Beryl A. 
Assign. Date: 11/13/2017 
Description: Search and Seizure Warrant 

SEARCH AND SEIZURE WARRANT 


In the Matter of the Seai^ch of ) 

(Briefly ^escribe the property^ to be searched ) 

or identify the person by name and address) ) 

INFORMATION ASSOCIATED WITH THE EMAIL ) 

ACCOUNT ^^^^^■iOMAIUCOM ) 

) 


——Any-autherized-law-eEforeemeHtoffieer- 


An application by a federal law e'nforcenient officer or ah attorney for the government requests the search | 

of the following person or property located in the Northern District of California I, 

(identify the person or describe the propertyi to be searched and give its location) I . |i 


See Attachment A, 


I find that the affidavitCs), or any recorded testimony^ establish probable cause to s.eai-ch and seize the person or propeify 
described above, and that such search will reveal (identify the person or describe.theproperty to be$eized)\ 


See Attachment B. 


YOU ARE COMMANDED to execute this waaant on or before November 20, 2017 (not to exceed 14 days) 
^ ill the daytime 6:00 a.m, to 10:00 p.m. □ at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the waiTant and a receipt for the property taken to the 
person from whom;, or from whose premises, the pipperty was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, dr an dfllcei’ present during the execution of the warrant, tnust prepare an inventory 
as required by law and promptly return this waitant and inventory to__ Hon. Beryl A. Howell _. 

(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. .§ 3103a(bT I find that itnmediate notification may have an adverse result listed in 18 U.SU. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for _ ddcys (not to exceed JO) □ uiitil, the facts justifying, the later Specific date of _ 


Date and time issued:- 






City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and tUte 
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Ap 93 (Rev. 11/133 Search Seizure. Warrant (Page 2) 



Return 


Cas.eNp.t 

Date and time warraiit executed: 

Copy of warrant and inventoiy left with: 

Inventoiy made in the presence of: 



Inventory of the property takM and name of any person(s) seized: 


^;Certification 

I declare tinder penalty qf perjury that this invehtoi7 is correct and .was returned along with the original warrant to the 
designated judge. 


Date:.. .. 

ExeGutiiig officer's signature 


Printed name and title 
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ATTACHMENT A 


This warrant applies to infonnation associated with the Google Mail Account 
l^gmaiLcom that is stored at premises owned, maintained, controlled, or operated 
by Google, a.company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043. 


1 
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ATTACHMENT B 

I. Information to be disclosed by Google 

To the extent that the information described in Attachntent A is within the possession, 
custody, Or control of the Google (hereinafter ‘The Provider”), regardless of whether such 
information is stored, held or maintained inside or outside of the United States, and including any 
emails, records, files, logs, or information that have been deleted but are still available to the 
Provider, the Provider is required to disclose the following information to the government for each 
account or identifier listed in Attachment A: 

aT" The contents of all“emailsh^ciated wthThe account, including stored or preserved 

copies of emails sent to and from the account, diaft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. All. records pertaining to communications between the Provider and any person 
regarding the account, including Contacts with support services and records of 
actions taken; and other identifiers, records of session times aiid durations, the date 
on which the account was created, the length of ser vice, the types of service utilized, 
the IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative e-mail addresses provided 
during registration, all Other user names associated with the account, all account 
names associated with the subscriber, methods Of connecting; 
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f. All search history or web history; 

g. All records indicaiting the seiwices available to subscribers of the accounts; 

h. All usernames associated with or sharing a, login IP address or browser cookie with 
the accounts; 

i. All cookies, including third-party cookies, associated with the user; 

j. All records that are associated with the machine cookies associated with the user; 
and 

k. All telephone or instrument numbers associated with the Account (including MAC 

- addresses—Electronic ^erial—lNlumbers - (—ESN—),—^Mobile—Electronic—Identity- 

Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile Identification 
Numbers (“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”), International Mobile 
Subscriber Identifiers (“IMSI”), or International Mobile Equipment Identities 
(“IMEI”). 

n. Information to be Seized by the Government 

All information described above in Section I that constitutes evidence, contraband, fruits, 
and/or instrumentalities of violations of 18 U.S.C. § 1014 (false statements to a financial 
institution), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C, § 1344 (bank fraud), and 18 U.S.C. § 1956 
(money laundering), as well as 18 U.S.C. § 951 (acting as an unregistered foreign agent) and the 
Foreign Agents Registration Act (“FARA”), 22 U.S.C. § 611 et s&q., involving Michael Dean 
Cohen and occurring on Or after June 1, 2015, including, for each account or identifier listed oii 
Attachment A, Information pertaining to the following matters: 

a. Communications, records, documents, and other files involving Essential 
Consultants, LLC; 

b. Communications, records, documents, and other files that false representations to, a 
financial institution with relation to intended the purpose of an account or loan at 
that financial institution; the nature of any business or entity associated with an 
account a finanoial institution; the source of fimds flowing into an account; or the 
purpose or nature of any financial transactions involving that financial institution; 
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c. 


d. 


e. 


Records of any funds or benefits received by or offered to Michael Dean Cohen by, 
or on behalf of, any foreign government, foreign officials, foreign entities, foreign 
persons, or foreign principals; 

Communications, records, documents, and other files that reveal efforts by Michael 
Dean Cohen to conduct activities on behalf of, for the benefit of, or at the direction 
of any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 

Evidence indicating how and when the account was accessed or used, to deteimine 


-the-geographic^andehronologicaLcontextofaccountaccess,jise, 


a nd events relatin g 


to the crimes under investigation and to the account owner; 

f. Evidence indicating the account owner’s state of mind as it relates to the crimes 
under investigation; 

g. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); and 

h. The identity of any person(s)—■including records that help reveal the whereabouts 
of the personfs)—who communicated with the account about any matters relating 
to activities conducted by Michael Dean Cohen on behalf of, for the benefit qf, or 
at the direction of any foreign government, foreign officials, foreign entities, 
foreign persons, or foreign principals. 

III. Review PrbtpcDls 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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Exhibit C 
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AO -93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 


In the Matter of the Search of 
(Briefly describe the. property to be. searched 
or iderilijy ihe.person by name and address) 


JNEOR MATION associat ed with the account 
^^■I^^^^^Hwhich is stored at the 

^^^^REMISES OF i&1 INTERNET, iNC. 


) 

) 

) 

) 

) 

) 


Case; i;17-mj-"00854 

Assigned To : Chief Judge Howell, Beryl A. 

Assign, Date: 11/13/2017 

Description: Search and Seizure Warrant 


SEARCH AND SEIZURE WARRANT 


—Any-authoTized-Iaw-eDfGTGemeBt-Gffiee-r- - ---—-— 

An .application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the Northern __ District of _ California 

(identify the person or describe the property to be searched and give Us location)\ 


See Attachment A. 


r find that the affidavitts), or any recorded testimony, establish pi^obable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the properly to be seized): 

See Attachment B. 


F 


I 


if 

|! 

I 

I 


I 

II 

I 


I 


YOU ARE COMMANDED to execute this waiTant on or before 


November 20, 2017 


^ (not to exceed 14 days) 


in the daytime 6:00 a,m. to 10:00 p.m. D at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt, for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this- wairant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this -warrant and inventory to Hon. Beryl A, Howell . 


(United States ^4agistra^e Judge) 

□ Pursuant to 18 U.S.G/§ 3i03a(b),l find that immediate notification may have.an adverse result listed in 18 U,S.C. 

.§ 2705 (except for delay of trial), and authorize the officer executing this wan'ant to delay notice to the person who, or whose 
propeity, will be searched or seized (check the appropriate box) 

P for_days (not to exceed 30) □ until, the facts justifying, the later specific date of __ 


Date- and time issued: // / / .j/ 

City and state: Washington, DC 


Judge V sigi'iature 

rign. Beryl A. Howe]l, Chief U.S. District Judge 


Printed name and tide 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page.2) 



Rpturji 


Case No,: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of : 


Inventory of the property taken and name of ariy person(s) seized: 



Certification 


1 deplare. under penalty of pequry that this inventory is correct and was returned along with the original warrant to the 
designated judge, 


Date: 


Executing officer *s signahire 


Printed nctm^ Md title 
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ATTACHMENT A 


This warrant applies to information associated with the email 



is stored at premises owned, maintained, controlled, or operated by l&l Internet, Inc. (‘T&l”), an 
electronic communication arid/or remote computing service provider headquartered in Sunnyvale, 
California. 


1 
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ATTACHMENT B 

I. Information to be disclosed by l&l 

To the extent that the infoiTnation described in Attachment A is within the possession, 
custody, or control of the l&l (hereinafter “the Provider”), regardless of whether suph infonhation 
is stored, held or maintained inside or outside of the United StateSj and including tiny emails, 
records, files, logs, or information that have been deleted but ai’e still available to the Provider, the 
Provider is required to disclose the following information to the government for each account or 
identifier listed in Attachment A; 

~ei~ The contents ofail emaiis-assoeiated with tlre'arccoontrimcltrdhigBtored or preserved' 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone. numbers and other identifiers, 
records obsession times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registmtion, methods of connecting, log files, and means arid 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. All records pertaining to communications between the Provider and any person 
regarding the account, iricludirig contacts with support services and records of 
actions taken; and other identifiers, records of session times arid duratioris, the date 
ori which the account was created, the length of service, the types of service utilized, 
the IP address used, to register the account, log-iri IP addresses a:ssoeiated with 
session times arid dates, account status, alternative e-mail addresses provided 
during registration, all other user names associated with the account, all account 
names associated with the subscriber, methods of connecting; 
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fi All search history or web history; 

g. All records indicating the seiwices available to subscribers of the accounts; 

h. All usernames associated with or sharing a login IP address or browser cookie with 
the accounts; 

i. All cookies, including tiiird-party cookies, associated with the user; 

j. All records that are associated with the machine cookies associated witli the user; 
and 

k. All telephone or instrument numbers associated with the Account (including MAC 

__!_addresses , Pt ect.rnnic Serial Numbers (“ESN’^, Mobile Electronic Identity 

Numbers (“MEIN”), Mobile Equipment Identifier (“MBID”), Mobile Identification 
Numbers ("MIN”), Subscriber Identity Modules ("SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”), International Mobile 
Subscriber Identifiers (“IMSI”), or International Mobile Equipment Identities 
(“IMEI”). 

II. Information to be Seized by the Government 

All information described above in Section I that constitutes evidence, contraband, fraits, 
and/or instrumentalities of violations of 18 U.S.G. § 1014 (false statements to a financial 
institution), 18 U.S.C. § 1343 (wim fraud), 18 U.S.C. § 1344 (bank fraud), and 18 U.S.C. § 1956 
(money laundering), as well as 18 U.S.C. § 951 (acting as ah unregistered foreign agent) and the 
Foreign Agents Registration Act ("FARA”), 22 U.S.C. § 611 et seq., involving Michael Dean 
Cohen, including, for each account or identifier listed on Attachment A, inforination pertaining to 
the following matters: 

a. Communications, records, documents, and other files involving Essential 
Consultants, LLC; 

b. Communications, records, documents, and other files that false representations to a 
fmanoial institution with relation to intended the purpose of an accotnit or loan at 
that financial institution; the nature of any business or entity associated with aii 
account a financial institution; the source of funds flowing into an account; or the 
purpose or nature of any financial transactions involving that financial institution; 


3 
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c. Records of any funds or benefits received by or offered to Michael Dean Cohen by, 
or on behalf of, any foreign government, foreign officials, foreign entities, foreign 
persons, or foreign principals; 

d. Communications, records, documents, and other files that reveal efforts by Michael 
Dean Cohen to conduct activities on behalf of, for the benefit of, or at the direction 
of any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

e. Evidence indicating how and when the account was accessed or used, to determine 

—-—^the-gepgraph ie and-chronol ogical-context of aceountaGGes&,-usev and events-relating 

to the crimes under investigation and to the account owner; 

f. Evidence indicating the account owner’s state of inind as it relates to the crimes 
under investigation; 

g. ■ The identity of the person(s) who created or used the account, including records 

that help reveal the vvhereabouts of such person(s.); and 

h. The identity of any person(s)—including records that help reveal the whereabouts 
of the persoh(s)—who communicated with the account about any matters relating 
to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or 
at the direction of any foreign government, foreign officials, foreign entities, 
foreign persons, or foreign principals* 

III. Review Protocols 

Review of tlie items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorhey'-client and other 
operative privileges. When appropriate, the procedui'Cs shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 


4 
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AO 93 (Rev, 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 


In the Matter of the Search of ) 

(Briejly describe (he property to be searched ) 

or identify the person by name and address) ) 

INFORMATION ASSOCIATED WITH THE APPLE ID ) 
^^^^^■^GMAIL.COM THAT IS STORED AT ) 
PREMISES CONTROLLED BY APPLE, INC. ) 


ase: 17-mj-00570 

ssigned To ; Howell, Beryl A. 

ssion Dote 8/7/2017 

escription; Search and Seizure Warrant 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the __ Northern _ District of _ 

(identify the person or describe the property to he searched and give its location}'. 


See Attachment A. 


1 find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

See Attachment B, 


YOU ARE COMMANDED to execute this warrant on or before Aij'gLIgt 21, 2017 (not to exceed 14 days) 

^ in the daytime 6:00 a.m. to 10:00 p.m. O at any time in the day or night because good cause has been established. 

Unless delayed notice Is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 

as required by law and promptly return this warrant and Inventory to___ Hon. Beryl A. Hovyell. .... 

(United States Magistrate Judge) 


. □ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

□ for ____ days (not to exceed30) □ until, the facts justifying, the later specific date of ___ 



City and state: Washington, DC 


Hon, Beryl A. Howell, Chief U.S. District Judge 
Printed name and title 



















Case l:18-cr-00602-WHP Document 48-6 Filed 07/18/19 Page 58 of 80 


AO 93 (Rev. 11/13) Search and Seizure Wanant (Page 2) 


Case No.; 


Return 


Date and time warrant executed: 


Copy of warrant and inventory left with: 


Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 


GeftiUc^tidh 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated Judge. 


Date: 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 

This warrant applies to information ’associated with the Apple ID 
@gniaii»coni that is stored at premises owned, maintained, controlled, or operated 
by Apple, Inc. (“Apple”), a company headquartered at 1 Infinite Loop, Cupertino, CA 95014, 
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ATTACHMENT B 

I. Information to be disclosed by Apple, Inc. 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Apple, Inc. (hereinafter “the Provider”), regardless of whether such 
information is stored, held or maintained inside or outside of the United States, and including any 
emails, records, files, logs, or information that have been deleted but are still available to the 
Provider, the Provider is required to disclose the following information to the government for each 
account or identifier listed in Attachment A: ____ 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, 
the IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative e-mail addresses provided 
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during registration, all other user names associated with the account, all account 
names associated with the subscriber, methods of connecting; 

f. All search history or web history; 

g. All records indicating the services available to subscribers of the accounts; 

h. All usernames associated with or sharing a login IP address or browser cookie with 
the accounts; 

i. All cookies, including third-party cookies, associated with the user; 

j. All records that are associated with the machine cookies associated with the user; 

~~~ --__- .. — - ^ --— - 

k. All telephone or instrument numbers associated with the Account (including MAC 
addresses. Electronic Serial Numbers (“ESN”), Mobile Electronic Identity 
Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile Identification 
Numbers (“MIN”), Subscriber identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”), International Mobile 
Subscriber Identifiers (“IMSI”), or International Mobile Equipment Identities 
(“IMEl”). 

IL Information to be Seized by the Government 

All information described above in Section I that constitutes evidence, contraband, fruits, 
and/or instrumentalities of violations of 18 U.S.C. § 1014 (false statements to a financial 
institution), 18 U.S.C. § 1344 (bank fraud), 18 U.S.C. § 1956 (money laundering), ISU.S.C. §951 
(acting as an unregistered foreign agent), and 22 U.S.C. § 611 ef seq. (Foreign Agents Registration 
Act), involving Michael Dean Cohen and occurring on or after January 1,2016, including, for each 
account or identifier listed on Attachment A, information pertaining to the following matters; 

a. Communications, records, documents, and other files involving Essential 
Consultants, EEC; 

b. Communications, records, documents, and other files involving Bo and Abe Realty, 
EEC; 

c. Communications, records, documents, and other files that false representations to a 
financial institution with relation to intended the purpose of an account or loan at 
that financial institution; the nature of any business or entity associated with an 
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I 

f 

r 

account a financial institution; the source of funds flowing into an account; or the | 

purpose or nature of any financial transactions involving that financial institution; 

d. Records of any funds or benefits received by or offered to Michael Dean Cohen by, | 

or on behalf of, any foreign government, foreign officials, foreign entities, foreign | 

persons, or foreign principals; | 

e. Communications, records, documents, and other files that reveal efforts by Michael 
Dean Cohen to conduct activities on behalf of; for the benefit of or at the direction 
of any foreign government, foreign officials, foreign entities, foreign persons, or 

——foreign-principals;---—^--- —— -___ 

f. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

g. Evidence indicating the account owner’s state of mind as it relates to the crimes 
under investigation; 

h. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); and 

i. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)-—who communicated with the account about any matters relating 
to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or 
at the direction of any foreign government, foreign officials, foreign entities, 
foreign persons, or foreign principals. 
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Exhibit E 
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UNITED STATES DISTRICT COURT 
SOUTHDBRN DISTRICT OF NEW YORK 


la the Matter of a Warrant for All 
Content and Other Information 
Associated w ith the Email Accounts 
l@gmail.com, . 
I@gmail.com, and 

I Maintained at 
Premises Controlled by Google, hac., 
USAO Reference No. 2018R00127 




Search Warrant and Non-Disclosure Order 

TO: Google, Inc. (“Provider”) 


United States Attorney’s Office for the Southern Dishict of New York and the Federal 
Bureau of Investigation (collectively, the “Investigative Agencies”) 

United States 

Attorney’s Office for the Southern District of New York, and pursuant to the'provisions of the 
Stored Communications Act, 18 U.S.C. § 2703(b)(1)(A) and § 2703(c)(1)(A), and the relevant 
provisions of Federal Rule of Criminal Procedure 41, the Court hereby finds there is probable 
cause to believe the email accounts ^^^^^^^@gmail.com, ^^^|@gmail.com, and 

maintained at premises controlled by Google, Inc., contain evidence, 
fruits, and instrumentaUties of crime, all as specified in Attacliments A and B hereto. Accordingly, 
the Provider is hereby directed to provide to the Investigative Agencies, within 7 days of the date 
of service of this Warrant and Order, the records specified in Section 11 of Attachments A and B 
hereto, for subsequent review by law enforcement personnel as authorized in Sections III and IV 
of Attachments A and B. The Government is required to serve a copy of this Warrant and Order 
on the Provider within 7 days of the date of issuance. The Wanant and Order may be served via 


1. Warrant. Upon an affidavit of Special Agent 
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electronic transmission or any other means through, which the Provider is capable of accepting 
service. 

2. Non-Disclosnre Order. Pursuant to 18 U.S.C. § 2705(b), the Court finds that there is 
reason to believe that notification of the existence of this warrant will result in destruction of or 
tampering with evidence or flight from prosecution, or otherwise will seriously jeopardize an 
ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the 

'existenceuDf this^Warrantrand^Order to the listed subscriber or to-any other persOmfor a period-of- 

180 days from the date of this Order, subject to extension upon application to the Court if 
necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider 
for the purpose of receiving legal advice, 


3. Sealing. It is further ordered that tlris Warrant and Order, and the Affidavit upon which 
it was issued, be filed under seal, except that the Government may without further order of this 
Court seiwe the Warrant and Order on the Provider; provide copies of the Affidavit or Warrant and 
Order as need be to personnel assisting the Government in the investigation and prosecution of 
this matter; and disclose these materials as necessary to comply with discovery and disclosure 


obligations in any prosecutions related to this matter. 


Dated: New York, New York 







Date Issued 


Thnelss”"'^ 



Southern District 


02.282018 


2 
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Email Search Attachment A 
I. Subject Account and Execution of Warrant 

This warrant is directed to Google, Inc. (the “Provider”), headquartered at 1600 
Amphitlreatre Parkway, Mountain View, California 94043, and applies to all content and other 
information within the Provider’s possession, custody, or control associated with the email account 
l^gmail.comi (the “Subject Account”) for the time period referenced below. 
-ArlaW-enforcemenfoffieer-will-serve-this-warranfby-tr-ansmitting-it-via email or-another- 


appropriate manner to the Provider. The Provider is directed to produce to the law enforcement 
ofiScer an electronic copy of the information specified in Section II below. Upon receipt of the 
production, law enforcement personnel will review the information for items falling within the 
categories specified in Section IE below, 
n. Information to be Produced by the Provider 

To the extent within the Provider’s possession, custody, or control, the Provider is directed 
to produce the following information associated with the Subject Account: 

a. Email content. All emails sent to or horn, stored in draft form in, or otherwise 
associated with the Subject Account, including all message content, attachments, and header 
information (specifically including the source and destination addresses associated with each 
email, the date and time at which each email was sent, and the size and length of each email) 
limited to items sent, received, or created between November 14,2017 and the date of this warrant, 
inclusive. 


b. Address book information. All address book, contact list, or similar ioformation 
associated with the Subject Account 

c. , Subscriber and payment information. All subscriber and payment information 
regarding the Subject Account, including but not limited to name, username, address, telephone 
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niimber, alternate email addresses, registeation ff address, account creation date, account status, 
length of service, types of services utilized, means and source of payment, and payment history. 

d. Transactional records. All transactional records associated with the Subject Account, 
including any IP logs or other records of session times and durations, limited to items sent, 
received, or created between December 1,2014 and the date of this warrant, inclusive. 

e. Customer correspondence. All correspondence with the subscriber or others associated 

~TOtlrilre~Suhject”Acconntrincluding‘complaints7inq[uiries7nr other eontactswithsupport-serviees- 

and records of actions taken, limited to items sent, received, or created between December 1,2014 
and the date of this warrant, inclusive. 

f. Search History. All search history and/or web history associated with the Subject 
Account, limited to items sent, received, or created between December 1,2014 and the date of this 
warrant, inclusive. 

g. Associated content. All Google Docs, files maintained on Google Drive, and instant 
messages or Gchats associated with the Subject Account, limited to items sent, received, or created 
between December 1,2014 and the date of this warrant, inclusive. 

h. Preserved or backup records. Any preserved or backup copies of any of the foregoing 
categories of records, whether created in response to a preservation request issued pmsuant to 18 
U.S.C. § 2703(f) or otherwise. 

ni. Review oflnformation by the Government 

Law enforcement personnel (who may include, in addition to law enforcement ofihcers and 
agents, .attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, and outside technical experts under government control) are 
authorized to review the records produced by the Provider in order to locate any evidence, fruits, 
andinstrumentahties of violations of 18 U.S.C. §§ 371 (conspiracy to commit offense or to defraud 


022saoi& 


2 
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the United States), 1005 (false bank entries); 1014 (false statements to a financial institution), 1343 
(wire fraud), and 1344 (bank fraud), including the following: 

a. Communications, records, documents, and other files necessary to establish the identity 
of the person(s) who created or used the Subject Account; 

b. Communications, records, documents, and other files involving Sterling National 
Bank, Melrose Credit Union, and/or taxi medallions; 

cr^Catnmunicationsrrecordsrdocumentsyand other filesdnvolving-a"planrproposahror 
agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
medallions, and any associated debts or liabilities, to others, including to^^^^^^^^^^^and/or 
entities associated with him; 

d. Communications, records, documents, and other files involving Essential Consultants, 
T.T. C or Michael D. Cohen & Associates, including those which indicate the nature and purpose of 
payments made to or from Essential Consultants or Michael D. Cohen & Associates; 

e. Communications, records, documents, and other files necessary to establish the identity 
of any person(s) — includmg records that reveal the whereabouts of the person(s) — who 
communicated with the Subject Account about any matters relating to Essential Consultants, LLC, 
or about any plaii or proposal or.agreement for Michael D. Cohen and/or entities associated with 
him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, 
including to ^^^^^^^^md/or entities associated with him; 

f. Communications between the Subject Account and Jeffrey Getael relating to Michael 
D. Cohen’s bank accounts, taxes, debts, and/or finances; 

g. Communications, records, documents, and other files reflecting false representations 
to a financial institution with relation to the intended purp ose of an account or loan at that financial 


02.28.2018 


3 
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institution; the nature of any business or entity associated with an account at a financial institution; 
the source of funds flowing into an account; or the purpose or nature of any financial transactions 
involving that financial institution; 

h. Evidence indicating how and when the Subject Account was accessed or used, to 
determine the geographic and chronological context of account access, use, and events relating to 
the crimes under investigation and to the account owner; and 

Evidence indicaShglhASubj^tTAccount owner’sTntentwttrelatesAo'fhe^Subject 
Offenses under investigation. 

IV. Review Protocols 

Review of the items described in this Attachment shall be conducted pursuant to 
estabhshed procedures designed to collect evidence in a manner reasonably designed to protect 
any attomey-cUent or other apphcable privilege. When appropriate, the procedures shall include 
use of a designated “filter team,” separate and apart firom the investigative team, in order to address 
potential privileges. 


02.28.2018 


4 
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Email Search Attachment B 
I. Subject Account and Execution of Warrant 

This warrant is directed to Google, Inc. (the “Provider”), headquartered at 1600 
Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other 
information within the Provider’s possession, custody, or control associated with the email 
accounts ^^^^gmaihcom and (the “Subject Accounts”) for the time 

period-between-October-l,-2016-and-the-date-of-thisxvarrant,-inclusive.-—— 

A law enforcement officer will serve this warrant by transmitting it via email or another 
appropriate manner to the Provider. The Provider is directed to produce to the law enforcement 
officer an electronic copy of the information specified in Section E below. Upon receipt of the 
production, law enforcement personnel will review the information for items falling within the 
categories specified in Section IE below, 
n. Information to be Produced by the Provider 

To the extent within the Provider’s possession, custody, or control, the Provider is directed 
to produce the following information associated with the Subject Accounts: 

a. Email content. All emails sent to or from, stored in draft form in, or otherwise 
associated Avith the Subject Accounts, including all message content, attachments, and header 
information (specifically including the source and destination addresses associated with each 
email, the date and time at which each email was sent, and the size and length of each email). 

b. Address book information. All address book, contact list, or similar information 
associated with the Subject Accounts. 

c. Subscriber and payment information. All subscriber and payment information 
regarding the Subject Accounts, including but not limited to name, username, address, telephone 
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number, alternate email addresses, registration P address, account creation date, account status, 
length of service, types of services utilized, means and somce of payment, and payment history. 

d. Transactional records. All transactional records associatedwith the Subject Accounts, 
including any P logs or other records of session times and durations. 

e. Customer correspondence. All correspondence with the subscriber or others associated 
with the Subject Accounts, including complaints, inquiries, or other contacts with support services 

“aiKiTecDrds of actions takeuT^--——-—^-- 

f. Search History. All search history and/or web history associated with the Subject 
Accounts. 

g. Associated content. AU Google Docs, files mamtained on Google Drive, 'and instant 
messages or Gchats associatedwith the Subject Accounts. 

h. Preserved or backup records. Any preserved or backup copies of any of the foregoing 
categories of records, whether created in response to a preservation request issued pursuant to 18 
U.S.C. § 2703(10 or otherwise. 

m. Review oflnformation by the Government 

Law enforcement personnel (who may include, in addition to law enforcement officers and 
agents, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, and outside technical, experts under government control) are 
authorized to review the records produced by the Provider in order to locate any evidence, ffuits, 
and instrumentahties of violations of 18 U.S.C. §§ 371 (conspiracy to commit offense or to defraud 
the United States), 1005 (false bank entries); 1014 (false statements to a financial institution), 1343 
(whe fraud), and 1344 (banlc fraud), including the followmg: 

a. Communications, records, documents, and other files necessary to establish the identity 
of the person(s) who created or used the Subject Accounts; 

2 
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b. Cn nrmnimi catinns, records, documents, and other files involving a plan or proposal or 

agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
medallions, and any associated debts or liabihties, to and/or entities associated 

with him; 

c. Communications, records, documents, and other files necessary to establish the identity 
of any person(s) — including records that reveal the whereabouts of the person(s) - who 
communicated-withrthe Subject-Accouhts-about-any matters-relating-to any-plan or proposal-or 
agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
medalHons, and any associated debts or liabilities, to ^^^^^^^^^|a.nd/or entities associated 
with him; 

d. Communications between the Subject Accounts and others, including employees or 
representatives of Sterling National Bank, Mehose Credit Union, or other financial institution(s), 
regarding Michael D. Cohen’s finances; 

e. Communications, records, documents, and other files reflecting false representations 
to a financial institution with relation to the intended puipose of an account or loan at that financial 
institution; the nature of any business or entity associated with an account at a financial institution; 
the source of funds flowing into an account; or the purpose or nature of any financial transactions 
involving that financial institution; 

f. Evidence indicating how and when the Subject Accounts was accessed or used, to 

determine the geographic and chronological context of account access, use, and events relating to 
the crimes under investigation and to the account owner; . . 

g. Evidence indicating the Subject Accounts owners’ intent as it relates to the Subject 
Offenses under investigation. 


02.28,2018 


3 
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IV. Review Protocols 

Review of the items described in this Attachment shall be conducted pursuant to 
established procedures designed to collect evidence in a manner reasonably designed to protect 
any attorney-client or other applicable privilege. When appropriate, the procedures shall include 
use of a designated “filter team,” separate and apart from the investigative team, in order to address 
potential privileges. 



I 

I 

I 


If 
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UNTIED STATES DISTKICT COURT 
SOUTHERN DISTRICT OF NEW YORK 


In the Matter of a Warrant for All 
Content and Other Information 
_Asso ^ted with the Em ail Account 
maintained 

Premises Controlled by 1 & 1 Internet, 
Inc., USAO Reference No. 
2018R00127 


--SESRCH^WATHUa^TYiM)1N^DN-DlSCLOStIHE^^ - 

TO: 1 & 1 Intemet, Inc. (“Provider”) 

United States Attorney’s Office for the Southern District of New York and the Federal 
Bureau of Investigation (collectively, the “Investigative Agencies”) 


1. Warrant. Upon an affidavit of Special Agent the United States 

Attorney’s Office for the Southern District of New York, and pui'suant to the provisions of the 


Stored Communications Act, 18 U.S.C. §. 2703(b)(1)(A) and § 2703(c)(1)(A), and the relevant 
provisions of Federal Rule of Criminal Procedure 41, the Court hereby finds there is probable 
cause to believe the email accounl^^^^Q^^^^^^^naintained at premises controlled by 1 
& 1 Intemet, Inc., contains evidence, fruits, and instrumentalities of cfune, all as specified in 
Attachment D hereto. Accordiugly, the Provider is hereby directed to provide to the Investigative 


Agencies, within 7 days of the date of service of this Warrant and Order, the records specified in 
Section n of Attachment D hereto, for subsequent review by law enforcement personnel as 
authorized in Sections III and TV of Attachment D. The Government is requked to serve a copy 
of this Warrant and Order on the Provider within 14 days of the date of issuance. The Warrant 
and Order may he served via electronic transmission or any other means through which the 
Provider is capable of accepting service. 
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2. Non-Disclosure Order. Pursuant to 18 U.S.C. § 2705(b), the Court lands that there is 
reason to believe that notification of the existence of this warrant will result in destruction of or 


tamp ering with evidence or flight from prosecution, or otherwise wUl seriously jeopardize an 
ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the 


existence of this Warrant and Order to the listed subscriber or to any other person for a period of 
180 days from the date of this Order, subject to extension upon application to tihe Court if 
necessarj^excepIrthat ProviderTnay disclose this-Warranhand-Order-to-an attomey-for-Provider- 
for the purpose of receiving legal advice, 

3. Sealing. It is flirther ordered that this Warrant and Order, and the Affidavit upon which 
it was issued, be filed under seal, except that the Government may without further order of this 
Court serve the Warrant and Order on the Provider; provide copies of the Affidavit or Warrant and 
Order as need be to personnel assisting the Government in the investigation and prosecution of 
this matter; and disclose these materials as necessary to comply with discovery and disclosure 
obligations in any prosecutions related to this matter. 

Dated: New York, New York 





.«/ 


Date Issued 


Time Isi 



02 , 28,2018 


2 
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Email Search Attachment D 
I. Subject Account and Execution of Warrant 

This warrant is directed to 1 & 1 Intemet, Inc. (the “Provider”), headquartered at 701 Lee 
Road, Suite 300, Chesterbrook, Pennsylvania 19087, and applies to all content and other 
infomnation within the Provider’spossession, custody, or control associated with the email account 
(the “Subject Account”) for the time period between November 14, 2017 

-and the date oLthis-warrant^inclusive,-——--———- 

A law enforcement officer will serve this warrant by transmitting it via email or another 
appropriate maimer to the Provider. The Provider is directed to produce to the law enforcement 
officer an electronic copy of the information specified in Section II below. Upon receipt of the 
production, law enforcement personnel will review the information for items falling within the 
categories specified in Section III below, 
n. Information to be Produced by the Provider 

To the extent within the Provider’s possession, custody, or control, the Provider is directed 
to produce the following information associated with the Subject Account: 

a. Email content All emails sent to or from, stored in draft form in, or otherwise 
associated with the Subject Account, including all message content, attachments, and header 
information (specifically including the source and destination addresses associated with each 
email, the date and time at which each email was sent, and the size and length of each email). 

b. Address hook information. All address book, contact list, or similar information 
associated with the Subject Account. 

c. Subscriber and payment information. All subscriber ‘and payment information 
regarding the Subject Account, including but not Ihnited to name, username, address, telephone 
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number, alternate email addresses, registration P address, account creation date, account status, 
length of service, types of services utilized, means and source of payment, and payment history. 

d. Transactional records. All transactional records associated with the Subject Account, 
including any P logs or other records of session times and durations. 

e. Customer correspondence. All correspondence with the subscriber or others associated 
with the Subject Account, including complaints, inquiries, or other contacts with support services 

^and recordsTofactionstakem ’ 

f. Preserved or backup records. Any preserved or backup copies of any of the foregoing 
categories of records, whether created in response to a preservation request issued pursuant to 18 
U.S.C. § 2703® or otherwise. 

in. Review of Information by the Government 

Law enforcement personnel (who may include, in addition to law enforcement officers and 
agents, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, and outside technical experts under government control) are 
authorized to review the records produced by the Provider in order to locate any evidence, fruits, 
and instrumentahties of violations of 18 U.S.C. §§ 371 (conspiracy to commit offense or to deftaud 
the United States), 1005 (false bank entdes); 1014 (false statements to a financial institution), 1343 
(wire firaud), and 1344 (bank ffaud), including the following: 

a. Communications, records, documents, and offer files necessary to establish the identity 
of the person(s) who created or used ffe Subject Account; 

b. Communications, records, documents, and other files involving Sterling National 
Bank, Melrose Credit Union, and/or taxi medallions; 

c. Communications, records, documents, and other files involving a plan, proposal, or 
agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 


02 . 28.2018 
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medallions, and any associated debts or liabilities, to others, including to 



rnd/or 


entities associated with him; 

d. Communications, records, documents, and other files involving Essential Consultants, 
T.T. C or Michael D. Cohen & Associates, including those which indicate the nature and purpose of 
payments made to or from Essential Consultants or Michael D. Cohen & Associates; 


e. The identity of any person(s) - including records that reveal the whereabouts of the 


■person(s)"^whomoinmunicated'withThe-SubjectA;ccounf about anyTnattersuelatmg to EssentiaT 
Consultants, LLC, or about anyplan or proposal or agreement for Michael D. Cohen and/or entities 


associated with him to transfer any interest in taxi medallions, and any associated debts or 



and/or entities associated with him; 


liabilities, to others, including to 


f. Communications between the Subject Account and Jeffrey Getzel relating to Michael 
D. Cohen’s banlc accounts, taxes, debts, and/or finances; 

g. Communications, records, documents, and other files reflecting false representations 
to a financial institution with- relation to the intended purpose of an account or loan at that financial 
institution; the nature of any business or entity associated with an accoxmt at a financial institution; 
the source of fluids flowing iPto an account; or the purpose or nature of any financial transactions 
involving that financial institution; 

h. Evidence indicating how and when the Subject Account was accessed or used, to 
determine the geographic and chronological context of account access, use, and events relating to 
the crimes under investigation and to the account owner; and 

i. Evidence indicating the Subject Account owner’s intent as it relates to the Subject 
Offenses under investigation. 


02.28.2018 
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IV. Review Protocols 

Review of the items described in this Attachment shall be conducted pursuant to 
established procedures designed to collect evidence in a manner reasonably designed to protect 
any attorney-client or other applicable privilege. When appropriate, the procedures shall include 
use of a designated “filter team,” separate and apart from the investigative team, in order to address 
potential privileges. 



02.285018 













